diff --git a/.agents/MEMORY.md b/.agents/MEMORY.md
new file mode 100644
index 0000000..e64f65f
--- /dev/null
+++ b/.agents/MEMORY.md
@@ -0,0 +1,33 @@
+# Repo Memory
+
+Curated, reviewed knowledge for coding agents working in this repository.
+Memory is an accelerator, not a second source of truth.
+
+## Precedence (highest first)
+
+1. Source code and tests
+2. Executable configuration
+3. Accepted design records / docs
+4. `AGENTS.md`
+5. This memory
+
+If memory conflicts with anything above it, the memory is stale — propose a fix.
+
+## Topics
+
+- `memory/architecture.md` — durable architectural decisions and constraints
+- `memory/conventions.md` — validated conventions not obvious from the code
+- `memory/lessons.md` — hard-won lessons and recurring landmines
+- `memory/decisions.jsonl` — structured decision records (one JSON object per line)
+
+## Write policy
+
+Agents MAY read everything here and MAY add candidates under `proposals/`
+(one file per proposal, named `YYYY-MM-DD-<slug>.md`, with evidence links).
+Agents MUST NOT edit `memory/` directly; trusted memory changes only through
+reviewed commits that promote a proposal.
+
+## Prohibited content
+
+Credentials or secrets, personal data, raw transcripts or tool logs, session
+TODOs, high-frequency agent state, unverified external claims.
diff --git a/.agents/memory/architecture.md b/.agents/memory/architecture.md
new file mode 100644
index 0000000..5c2b852
--- /dev/null
+++ b/.agents/memory/architecture.md
@@ -0,0 +1,16 @@
+# Architecture
+
+Durable architectural decisions and constraints for this repository.
+
+## Strict CSP as a hard deployment constraint
+
+Deployment config serves every path with a strict Content-Security-Policy
+(`default-src 'none'; script-src 'self'; style-src 'self' 'unsafe-inline'`,
+plus `frame-ancestors 'none'`, `form-action 'none'`, `object-src 'none'`),
+alongside `X-Frame-Options: DENY`, `X-Content-Type-Options: nosniff`, and
+`Referrer-Policy: no-referrer`. Any change must work under this policy: no
+inline scripts, no CDN or other external origins for scripts, styles, or
+fonts; images are limited to same-origin and `data:` URIs.
+
+Authoritative source:
+- vercel.json
diff --git a/.agents/memory/conventions.md b/.agents/memory/conventions.md
new file mode 100644
index 0000000..ae5d83f
--- /dev/null
+++ b/.agents/memory/conventions.md
@@ -0,0 +1,5 @@
+# Conventions
+
+Validated conventions not obvious from the code.
+
+No entries yet.
diff --git a/.agents/memory/decisions.jsonl b/.agents/memory/decisions.jsonl
new file mode 100644
index 0000000..e69de29
diff --git a/.agents/memory/lessons.md b/.agents/memory/lessons.md
new file mode 100644
index 0000000..cd9d296
--- /dev/null
+++ b/.agents/memory/lessons.md
@@ -0,0 +1,5 @@
+# Lessons
+
+Hard-won lessons and recurring landmines.
+
+No entries yet.
diff --git a/.agents/proposals/README.md b/.agents/proposals/README.md
new file mode 100644
index 0000000..89c95bd
--- /dev/null
+++ b/.agents/proposals/README.md
@@ -0,0 +1,7 @@
+# Memory proposals
+
+Agents: drop candidate memories here, one file per proposal, named
+`YYYY-MM-DD-<slug>.md`. State the claim, the evidence (file paths, commits,
+test results), and why it is durable. A human reviews and either promotes it
+into `../memory/` in a reviewed commit or deletes it. Nothing in this
+directory is trusted context.
diff --git a/.gitignore b/.gitignore
index 245259b..a1c374d 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,2 +1,4 @@
 .vercel
 .env*
+.agents/private/
+.agents/state/
diff --git a/AGENTS.md b/AGENTS.md
index dfe7ea7..b5145b4 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -54,3 +54,10 @@ The canonical backlog is `docs/TODO.md`.
 - There are no tests to update; verify changes manually via the local server
   before considering them done, and don't introduce changes that violate the
   CSP in `vercel.json`.
+
+## Repo memory
+
+Curated agent memory lives in `.agents/` (index: `.agents/MEMORY.md`). Read it
+before substantive work. Propose additions as files in `.agents/proposals/`;
+trusted memory under `.agents/memory/` changes only through reviewed commits.
+Code, tests, and configuration always outrank memory.